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Abstract— With its long duration and high gain antenna 
(HGA) feed thermal constraint; the NASA Solar-TErestrial 
RElations Observatory (STEREO) solar conjunction mission 
phase is quite unique to deep space operations. Originally 
designed for a two year heliocentric orbit mission to primarily 
study coronal mass ejection propagation, after 8 years of 
continuous science data collection, the twin STEREO 
observatories entered the solar conjunction mission phase, for 
which they were not designed. Nine months before entering 
conjunction, an unforeseen thermal constraint threatened to 
stop daily communications and science data collection for 15 
months. With a 3.5 month long communication blackout from 
the superior solar conjunction, without ground commands, 
each observatory will reset every 3 days, resulting in 35 system 
resets at an Earth range of 2 AU. As the observatories will be 
conjoined for the first time in 8 years, a unique opportunity for 
calibrating the same instruments on identical spacecraft will 
occur. As each observatory has lost redundancy, and with 
only a limited fidelity hardware simulator, how can the new 
observatory configuration be adequately and safely tested on 
each spacecraft? Without ground commands, how would a 3- 
axis stabilized spacecraft safely manage the ever accumulating 
system momentum without using propellant for thrusters? 
Could science data still be collected for the duration of the 
solar conjunction mission phase? Would the observatories 
survive? In its second extended mission, operational resources 
were limited at best. This paper discusses the solutions to the 
STEREO superior solar conjunction operational challenges, 
science data impact, testing, mission operations, results, and 
lessons learned while implementing. 
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1. INTRODUCTION 


The STEREO mission and the challenges of the solar 
conjunction mission phase are described along with the 
adjustments required to continue science data return, 
necessary observatory and ground system changes, on-orbit 
observatory testing, and post conjunction results. As those 
that do not learn from history are doomed to repeat the 
mistakes, lessons learned are presented. 


2. STEREO MISSION AND THE CHALLENGE OF 
SOLAR CONJUNCTION MISSION PHASE 


STEREO (Solar-TErestrial RElations Observatory) is the 
third mission in the Solar Terrestrial Probes program of the 
National Aeronautics and Space Administration (NASA) 
Science Mission Directorate Sun-Earth Connection theme. 
The mission consists of two nearly identical spacecraft in 
heliocentric orbits designed to investigate the  three- 
dimensional structure of the Sun’s corona, the origin of 
coronal mass ejections (CME’s), and the dynamic coupling 
between CME’s and the Earth’s environment. This 
Heliophysics mission is managed by NASA Goddard Space 
Flight Center (GSFC). 


The two spacecraft were designed, integrated, and operated 
by Johns Hopkins University/Applied Physics Laboratory 
(JHU/APL) with instrument suites provided by the Naval 
Research Laboratory, University of California Berkeley, 
University of New Hampshire, and the Observatoire de 
Paris. Each spacecraft is equipped with four instrument 
suites, as follows. Note that the IMPACT, PLASTIC, and 
SWAVES instruments measure data from the solar wind 
that passes by the spacecraft; they are referred to as the in- 
situ instruments. 


e Sun-Earth Connection Coronal and Heliospheric 
Investigation (SECCHI) — imaging 


e In situ. Measurements of Particles and CME 
Transients (IMPACT) — particle detectors 


e Plasma and Suprathermal Ion 
(PLASTIC) — particle detectors 


Composition 


e STEREO WAVES (SWAVES) - electric fields 
Orbits 


The two STEREO spacecraft were launched October 26, 
2006 on a single launch vehicle into highly elliptical Earth 
orbits with apogee beyond lunar orbit. After several 
months, lunar flybys were employed to inject the spacecraft 
into heliocentric orbits, with STEREO Ahead’s orbit 
slightly inside Earth's (and therefore slightly faster than 
Earth), and with STEREO Behind’s orbit slightly outside 
Earth's (and therefore slightly slower than Earth). The 
resulting orbits cause the two satellites to move away from 
the Earth at a rate of 22° per year. See Figure 1 below. 
Noting the direction of the Earth’s revolution about the Sun, 
the positions of STEREO Ahead and STEREO Behind 
relative to the Earth gives rise to the nicknames “Ahead” 
and “Behind,” respectively, for the two spacecraft. 
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Figure 1. STEREO Orbits 


As suggested by Figure 1, about eight years after 
heliocentric orbit insertion, the two spacecraft pass behind 
the Sun (superior solar conjunction). Although the angular 
radius of the Sun when seen from the STEREO orbits is 
only about 0.25°, X-band communications are significantly 
degraded when the Sun-Probe-Earth (SPE) angle 


approaches 3° due to solar scintillation effects. For 
planning purposes, the STEREO program picked the 2° 
mark as the point to cease sending commands from the 
ground. It will take Ahead about 3.5 months to pass 
through this blackout region, and about 2 months for 
Behind. 


Command-Loss Timer 


STEREO is equipped with both a software command-loss 
timer (SCLT) and a hardware command-loss timer (HCLT). 
Both the timeout value and the corresponding action taken 
for the SCLT may be changed by mission operators. The 
SCLT may also be disabled. The HCLT is implemented in 
hardware/firmware. It cannot be disabled, and neither the 
timeout value nor the action taken can be changed after 
launch. 


The STEREO HCLT expires if no command is received 
from the ground within three days (72.332 hours, to be 
precise). This value was chosen based on the requirements 
for the immediate post-launch mission phase, where orbital 
maneuvers might be required every few days in order to 
avoid Earth impact and to achieve eventual heliocentric 
orbit. The value is also consistent with the STEREO 
mission concept of operations, which calls for daily station 
contacts. 


Among the many actions taken in response to an HCLT 
timeout, are: 


e Shutdown of all four scientific instrument suites 


e Avionics reset, including rebooting of the flight 
processors 


e Reboot the transponder in the communications 
subsystem 


e Power off the Star Tracker (ST) 
e Adjust heaters for low-power consumption 


As can be seen, collectively, these are drastic actions to 
take, and not without risk to spacecraft health. Therefore, 
an HCLT timeout is something to be avoided. In fact, in the 
almost 8 years of operation prior to initiation of solar 
conjunction planning, no HCLT resets occurred on either 
spacecraft. (We did, however, conduct several controlled 
commanded system resets — first to test the spacecraft safe 
mode, and later to activate a revised software application 
program. Commanded system resets are just as drastic.) 


The STEREO HCLT design, while necessary and 
appropriate for early operations, presents a serious problem 
for surviving the solar conjunction. The Ahead spacecraft, 
for example, experiences 35 HCLT timeouts during its long 
3.5 month communications blackout. 


Turning off the ST is particularly problematic. This action 
was included in the HCLT reset sequence because the 
spacecraft enters its safe mode (called Earth Acquisition, or 
EA mode) following a system reset, and safe mode does not 
require the ST. Instead, it relies on coarse Sun sensors and 
gyroscopes in the Inertial Measurement Unit (IMU) to 
maintain a power-positive sun-pointing attitude. Because of 
the aging of the STEREO gyros (see below), relying on 
gyros at this point in the mission is very risky. It is 
preferred to keep the ST powered on and locked onto stars 
through the system reset, if possible. But, by its very 
nature, the HCLT reset sequence cannot be changed. 
Hence, the solar conjunction plan must address this 
situation. 


Antenna Thermal Issue 


STEREO uses a 1.2 m parabolic dish as its High Gain 
Antenna (HGA). This is the spacecraft's primary means of 
communication. The HGA is gimbaled about the spacecraft 
Y-axis. The nominal attitude maintains the spacecraft X- 
axis pointing at the Sun, and keeps the Earth in the 
spacecraft X-Z plane, on the —Z side. Thus, the HGA 
rotation axis is perpendicular to the Sun-Earth plane. By 
rotating the HGA gimbal, the flight software maintains the 
HGA boresight on the Earth as the spacecraft proceeds on 
its path around the Sun. 


As the spacecraft approaches superior solar conjunction, 
sunlight falls more directly into the parabolic dish and gets 
concentrated at the focus. Even though the dish is flat 
black, this effect drives the antenna feed temperature to the 
point where damage is possible. See Figure 2. Specifically, 
after analyzing the materials on the antenna feed, it was 
concluded that degradation would start around 150°C, and 
actual damage would occur around 170°C. Projections 
indicate that if the HGA is allowed to point at the Earth 
through the solar conjunction, the temperature would greatly 
exceed the damage point. 


Figure 2. STEREO High Gain Antenna 1.2m parabolic 
dish 


Moving the HGA boresight away from the Sun by just a few 
degrees has a dramatic beneficial effect on the feed 
temperature, but interrupts communications with Earth. 


This thermal issue was not analyzed during the design phase 
because the goal for mission life was set at five years, and 
the issue did not arise until mission year eight. While it 
may seem short-sighted to stop the analysis at five years 
(and it is), this is typical of the type of management 
decisions that must be made in order to contain development 
costs. 


The antenna thermal issue presents one of the biggest 
challenges for operating STEREO through the solar 
conjunction period. In fact, the issue presents a problem for 
many months before the actual conjunction and continues 
for many months after the conjunction. Altogether, the “hot 
zone” for HGA operations spans up to 15 months (447 days) 
on Ahead, and 13 months (397 days) on Behind. 


HGA Thermal Model 


In early April, 2014, monitoring of the HGA feed 
temperatures as a function of time showed temperatures 
increasing at an alarming rate in Figure 3: 
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Figure 3. STEREO-B HGA feed temperature days 
2014-000 through 096 


Combining temperature telemetry with spacecraft 
ephemerides enabled examination of the direct relationship 
between HGA feed temperature and SPE angle. On looking 
at the data in this way, it was observed that as time moved 
forward, the SPE angle for both STEREO-A (red) and 
STEREO-B (blue) reduces, and temperature increases 
rapidly (towards the left on this chart). At this point, it 
became clear that temperatures would very quickly increase 
above the 136°C saturation limit of the temperature sensor, 
and perhaps beyond the 170°C limit at which damage to the 
hardware would become an issue. For this reason, it was 
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agreed not to allow the HGA to get to temperatures above 
125°C. This would keep the antenna below the saturation 
limit, yet allow time to react should events warrant. 


To better understand and predict this behavior, a thermal 
model of the HGA would be needed. The first step in 
creating a model was to take advantage of similar data from 
two spacecraft by normalizing both curves to a uniform 
distance of | AU (STEREO-A is in reality a bit closer to the 
Sun than | AU and STEREO-B is a bit further). Plotting 
those results revealed a virtual single curve dependent only 
on the HGA/SPE geometry: 


120 


® 


G 5 216 38 28 38 8 


Sun-Probe-Earth Angle (degrees) 


Figure 3. HGA temperatures normalized to 1 AU from 
Sun (STEREO-A (red) & STEREO-B (blue)) 


There was finite time for planning, since changing the orbit 
of either spacecraft was not an option. Clearly the HGA 
would have to be carefully managed, but as the primary 
means of communications with Earth, managing meant a 
reduction in data rates, if not a total loss of data for some 
period of time. The difficulty here would be to manage the 
HGA in such a way so as to minimize the effects of this 
solar focusing while maximizing the ability of both 
spacecraft to maintain contact with Earth — at as high a data 
rate as possible. 


The question now would be how high would the 
temperature ultimately go? With no basis in the physics of 
the problem, extrapolations from curve fits were fine for 
short term predictions. However, without physics in the mix 
they would prove unreliable for long term planning. 


Given the diameter and focal length of the STEREO HGA, 
as well as the focal plane assembly diameter and spacing 
from the HGA itself it would be possible to construct a first 
order thermal model of the HGA. When complete, the 
model would accommodate not only the rough solar 
focusing discussed earlier, but heating of the HGA dish by 
the Sun and the subsequent heating of the focal plane by IR 
radiation from the hot dish. Once delivered, the curve 
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resulting from the model was added to the plot of the 
existing normalized data to confirm agreement in Figure 4: 
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Figure 4. Thermal model (black) with normalized 
STEREO-A (red) & STEREO-B (blue) HGA 
temperatures 


With this, it would now be possible to adjust the curve for 
distance specific to each of the two spacecraft, which could 
be used in the time domain to allow future planning as 
conjunction activities moved forward. Once done, these 
relationships could be used to predict temperatures of the 
HGA for each spacecraft if the HGA were to keep pointing 
at Earth throughout the conjunction. In the case of 
STEREO-A, the HGA would experience temperatures 
above the predetermined 125°C comfort limit from August 
of 2014 through February of 2016, a period of well over a 
year. STEREO-B would violate the limit from November of 
2104 through January of 2016, a few months less than 
STEREO-A, but a long time nonetheless. The next step 
would be to create a means of mitigating the problem. 


Side Lobe Operations 
Communications 


and Radio Frequency (RF) 


After data analysis and testing on each spacecraft it was 
shown that moving the HGA boresight away from the Sun 
by just a few degrees had a dramatic beneficial effect on the 
feed temperature. By using the HGA side lobes, a level of 
RF communication can be maintained with the spacecraft 
and reduce thermal effects. Testing revealed that both the 
command and telemetry links can be maintained by 
switching from the main lobe of the HGA antenna pattern to 
either the first or second side lobes, located about ~3° and 
~6°, off the boresight. The big drawback to using the side 
lobes is the signal strength drops by | to 3 orders of 
magnitude. This forces the implementation of significantly 
reduced data rates and requires the use of NASA’s Deep 
Space Network (DSN) 70 meter ground stations for daily 
contacts. 


The onboard software uses ephemerides for the spacecraft 
and Earth to compute the desired HGA gimbal angle. 
Because the signal strength on the side lobes is so low and 
because the widths of the lobes are thinner than that of the 
main lobe, it is important that the onboard software have 
reasonably accurate ephemerides. This requirement 
translates to the need to periodically update the onboard 
ephemerides during the many months of side lobe usage. 
This method for using the HGA side lobes was implemented 
and performed as predicted. 


At low SPE angles, the Earth is near the edge of the low 
gain antenna’s (LGA) hemi-spherical beam pattern. It was 
suggested that mission operations conduct a test to verify 
the LGAs signal would be receivable at low SPE angles. As 
the LGAs were not designed to operate at the 2 AU Earth 
range, their performance was tested on the Ahead 
observatory on June 7" 2014 at a SPE angle of ~10.2°. The 
spacecraft was rotated twice around the spacecraft to Sun 
line. The first rotation characterized the signal for the -Z 
LGA, and the second rotation characterized the signal for 
the +Z LGA. The test results showed that both 
commanding and telemetry at very low data rates could be 
achieved during some portion of the rotation, see Figure 5. 
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Figure 5. STEREO Ahead High Gain Antenna (HGA) 
pattern, showing side lobes 


As the SPE angle began to approach 0° a steady increase in 
dropped frames and bit error rate was expected due to solar 
scintillation effects. Based on data from DSN, at the X- 
band frequencies, noticeable link degradation was expected 
as the SPE approached 3°. Around a 2° SPE angle, the link 


degradation should be much more severe but the link could 
be closed depending on the degree of solar scintillation. 
Around a 1.5° SPE angle, the link was expected to be 
extremely hard to detect and maintain. The spacecraft was 
also going to be operating at lower data rates than initially 
thought due to the HGA feed temperature issue. Based on 
these assumptions, it was decided that the spacecraft would 
operate in solar conjunction mode while the SPE angle was 
less than 2°. In reality as the SPE decreased, the link 
performed both better and worse than originally estimated. 
It was observed that below ~3.3° SPE angle the RF signal 
became very vulnerable to solar activity. When there was 
high solar activity within the line between the spacecraft and 
Earth, the signal degradation was much worse than 
expected. However when solar activity was fairly minimal, 
the signal degradation was much less than anticipated. As 
the SPE angle continued to decrease, solar activity became 
an increasing factor in the overall link degradation. At least 
some frames were able to be decoded on the HGA down to 
a 1.7° SPE angle while the spacecraft was rotating. Below 
this point, DSN was not tracking the spacecraft entering and 
exiting superior solar conjunction. 


Aging Spacecraft Components 


The longevity design requirement for STEREO was just two 
years, with a design goal of five years. Thus, both STEREO 
spacecraft have greatly exceeded expectations. Most 
hardware has shown no aging effects at all. However, the 
gyroscopes in the IMUs and the ST have some issues. 


Each spacecraft is equipped with a pair of IMUs, with each 
IMU containing three orthogonal ring laser gyroscopes 
(RLGs) and three orthogonal accelerometers. The original 
operational concept was to fly with one IMU on at all times. 
The second IMU unit was to be kept powered off as a cold 
spare. In the event of an IMU fault, software onboard 
autonomously swaps to the backup IMU. 


As gyros aged (and failed) the mission was forced to change 
to a new concept of operations called Reduced Gyro 
Operations (RGO). In RGO, the spacecraft “flies” on ST, 
sun sensors, and the Guide Telescope (essentially, a high- 
precision sun sensor), with both IMUs turned off. The 
(backup) IMU is turned on only for special events, such as 
comet observations or thruster-firing for momentum 
management. This changes the IMU duty cycle from 100% 
to less than 3%, thus prolonging the remaining life of the 
IMUs. 


The change required some adjustment of parameter values 
in the attitude determination and control software, as well as 
new onboard autonomy policies to maintain spacecraft 
health. For example, if the ST were to suddenly lose lock 
on stars, the system would need to autonomously power-up 
its only remaining fully-functional IMU. 


STEREO Ahead switched to RGO in September 2013 and 
STEREO Behind in February of 2014. There was some 
observed degradation in pointing performance without gyro 


measurements, but the system was still able to meet or 
exceed its pointing requirements. From this point forward, 
both spacecraft were operating with one failed IMU, and 
one seriously aged IMU, using RGO to preserve the life of 
the remaining functional IMU. 


Each spacecraft is equipped with a single ST. With the 
IMUs in a precarious state, the ST is relied upon much more 
than during the early years of the mission. By and large, the 
ST has performed extremely well. There have been a 
handful of cases, however, where the ST “dropped lock,” 
i.e., failed to provide attitude solutions for extended periods 
of time (hours). In most cases, no root cause for the outages 
has been determined. In each case, eventually, the ST 
resumed normal operations. This phenomenon was dubbed 
the “lazy ST.” 


There is a known aging issue with this ST: its charge- 
coupled device (CCD) can accumulate radiation damage 
after years in space. The vendor had advised that lowering 
the CCD temperature can mitigate this problem. The ST is 
equipped with a Thermal Electric Cooler (TEC) to keep the 
ST at or below room temperature. The set point for the TEC 
can be changed by command. While there is insufficient 
data to make any statistically significant conclusion about 
the impact of possible radiation damage on the lazy ST 
behavior, lowering the TEC set point was an option if the 
lazy ST behavior became more than an occasional nuisance. 


3. SOLAR CONJUNCTION PLAN AND 
IMPLEMENTATION 


The solar conjunction mission phase consists of three 
periods of operations; two side lobe operations periods, 
before and after solar conjunction, and the actual superior 
solar conjunction period. Side lobe operations are required 
for several months before and after solar conjunction to 
maintain the HGA feed assembly temperature to within 
measureable limits while maintaining some level of ground- 
communications. The Table 1 lists the approximate 
duration of each period. 


Table 1. Solar Conjunction Mission Phase Durations 


Pre-Solar pupETOT Post-Solar 
: : Solar : ‘ 
Conjunction Con; . Conjunction 
Gays) onjunction (days) 
(+2°) (days) 
Ahead 
Observatory are ea a 
Behind 
Observatory = oe 28° 


As the STEREO mission was in its 8"" year of operations 
since launch, and NASA highly desired that the mission 
continue post solar conjunction, the following priorities, or 
“Laws of Solar Conjunction”, were established by mission 


systems engineering to guide the schedule and use of the 
limited operational resources. 


1. Take all reasonable precautions to keep the 
observatory safe. 


2. Return to normal science operations as soon as 
reasonably possible. In cases where this law 
conflicts with the First Law, the First Law takes 
precedence. 


3. Conduct science operations during conjunction, if 
reasonably feasible. In cases where this law 
conflicts with the first two, the first two laws take 
precedence. 


Due to limited operational resources and the need to return 
to nominal science operations on the HGA main lobe as 
soon as possible, a goal for implementing this mission phase 
is to minimize operational changes to the system, ie., 
procedures, ground software, memory objects, and daily 
cadence. This goal has the additional advantage of building 
upon well-tested and operationally-exercised system- 
configurations and procedures, while reducing some risk of 
introducing completely new system-configurations. 


Differences between side lobe operations and nominal 
science operations primarily consist of the following: 


e Lower data rates 


e Daily 70 meter 3 hour supports to return limited 
science 


e 34 meter supports, as available, to provide real- 
time space weather data 


e Recording space weather for the _ in-situ 
instruments for the duration of the side lobe 
operations periods 


e =Re-partitioning the solid state recorder (SSR) for 
the duration of the solar conjunction mission 
phase 


e Spacecraft telemetry playback only during each 
track, no science telemetry playback 


e No instrument stored command buffer dumps 
during each track 


e Load momentum dump commands the track 
before executing 


In February of 2015, prior to the Ahead observatory 
entering solar conjunction, a project-level solar conjunction 
readiness review was held to evaluate the readiness of the 
project for conducting the STEREO Solar Conjunction 
mission phase. The review board consisted of NASA 
GSFC, science teams, critical STEREO spacecraft bus 


system leads, and mission operations managers. After 
action item adjudication, project approval to proceed was 
granted. 


The entry and exit into the solar conjunction was at the 2° 
SPE angle to ensure communication and verify the required 
observatory configuration. System momentum was set to 8 
Nms to minimize the need for autonomous momentum 
dumps during the solar conjunction blackout period. Upon 
entry into the superior solar conjunction, each observatory 
was commanded, via an absolute timetag in the on board 
startup sequence, to rotate the spacecraft about the Sun-line 
at 5 degrees/minute to minimize system momentum build- 
up. As the 72.332 hour HCLT cannot be changed, each 
observatory undergoes a system reset every three days, 
thereby reinitializing the state of the observatory. As the 
SWAVES instrument uses minimal power and its default 
power-on configuration provides routine science, it 
remained on and was power-cycled with each three day 
HCLT system reset to continue to record science data at | 
packet per minute. 


Upon exiting the solar conjunction blackout period at 2° 
SPE angle, each observatory was commanded, via an 
absolute timetag in the on board startup sequence, to return 
to the nominal 3-axis stabilized attitude. The Ahead 
observatory was recovered from solar conjunction in early 


July of 2015 on the 2™ side lobe of the HGA after it reached 
the 2° SPE angle. Daily DSN communications on the 2" 
side lobe were resumed using an eight hour daily track for 
six weeks to playback the spacecraft data for analysis. 
Instruments were powered on and reconfigured for 
continuing limited real-time science, and the IMPACT and 
PLASTIC in-situ instruments resumed recording space 
weather at the one packet per minute rate. 


In November of 2015 the Ahead observatory returned back 
to the main lobe of the HGA, at a 1° offset which it rode 
along to the center of the main lobe which was reached at 
the end of December. All of the data on the SSR was 
played back twice to ensure completeness, the SSR was re- 
partitioned back to the nominal science configuration. Note 
that as Earth Acquisition mode has been discontinued, see 
section 4, there was an additional 108.7 Mbits in three Earth 
Acquisition mode SSR partitions which was re-allocated to 
the instrument partitions. 


A timeline depicting the significant events for each 
observatory during the solar conjunction mission phase is 
shown in Figures 6 & 7. Note that for comparison, the 
timeline scale is the same for both observatories. 
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Figure 6. STEREO Ahead Timeline for Superior Solar Conjunction 
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Figure 7. STEREO Behind Timeline for Superior Solar Conjunction 


4. SCIENCE DATA RETURN 


While off-pointing the HGA to protect the feed assembly 
from damage, there is a greater than 20 dB loss in RF signal 
levels during side lobe operations. This necessitates using 
lower data rates for daily communications. Using the three 
DSN 70 meter stations, through testing, the sweet spot for 
the optimal uplink and downlink signals were selected to 
provide a 6 dB uplink margin and 2 dB downlink margin as 
listed in Table 2. The downlink rates for the 70 meter 


stations still allow for limited real-time science data return. 
The DSN 34 meter subnet, including the three European 
Space Agency (ESA) deep space stations, can also be used 
for daily limited real-time science data return, spacecraft 
state of health checks, and anomaly recovery, at very low 
downlink rates. Note that the ranging performance is low 
on side lobe operations and intermittent loss of ranging lock 
did occur. Also, ranging was disabled during 34m DSN 
supports to provide additional downlink margin. 


Table 2. STEREO Side Lobe Data Rates 


With the low downlink rates and nominal 3 hour 70 meter 
daily supports, spacecraft housekeeping generation rates 
needed to be reduced. As the data return concept records all 
spacecraft telemetry packets generated and it was highly 
desired to minimize changes to the spacecraft and ground 
configuration for solar conjunction operations, real-time 


70 meter 34 meter HGA 
Downlink Uplink Downlink Uplink Angle Bias Ranging Mod 
Rate Rate (bps) Rate Rate (bps) (deg) Index (rads) 
(kbps) (kbps) 
Ahead 1* Side Lobe 10 500 1 125 3.2 0.305 
Ahead 2" Side Lobe 3 125 0.633 125 6.1 0.61 
Behind 1° Side Lobe > 500 1 125 3.4 0.305 
Behind 2" Side Lobe 125 0.633 125 6.2 0.61 
Nominal Rates (Main Lobe) 30 2000 160 2000 0 0.305 


spacecraft housekeeping telemetry rate was reduced by 95% 
to 0.14 kbps. 


The SSR was repartitioned to allow for recording spacecraft 
housekeeping during side lobe and solar conjunction 
operations, for 335 days (maximum 2™ side lobe duration). 


The SSR capacity was split with in-situ instruments 
receiving half for recording space weather data for the 
duration of side lobe operations at one packet per minute 
each and half for spacecraft housekeeping. Due to the large 
recording volume necessary for images, the SECCHI 
instrument did not record any data for the solar conjunction 
mission phase, only real-time science was provided. To 
minimize the impact of the changes on the operational 
system, the same number of partitions was maintained by 
zeroing out unused partitions. 


To maintain the health and safety of the observatories, the 
daily spacecraft housekeeping volume is 11.9 Mbits which 
requires the following playback durations each day using 
the side lobe downlink rates: 


e 34 minutes to playback @ 10 kbps 
e 3 hours (or track duration) @ 3 kbps 


As the recorded science volume cannot be supported with 
the side lobe downlink rates, daily SSR playbacks of science 
data are not possible until the return to the HGA main lobe. 
To allow the in-situ instrument teams to monitor the 
recording of the space weather data for the possible 16 
month duration of the side lobe operations, the SSR 
Prediction data product was modified to display the current 
percent full of each partition. 


Initially, the instruments were to be off during the side lobe 
operations as the spacecraft and Mission Operations Center 
(MOC) were not setup for collecting, returning, and 
processing science data at low data rates. Once Ahead solar 
conjunction spacecraft testing was completed in July 2014, 
science telemetry allocations were coordinated with the 
science teams. The instrument teams have the following 
real-time telemetry allocations during side lobe operations: 


e 1° HGA side lobe = 7.4 kbps of 10 kbps data rate 
e 2" HGA side lobe = 1.7 kbps of 3 kbps data rate 


Note that the 1* side lobe allocation includes an allocation 
for playing back 48 hours of spacecraft SSR volume. 


In Table 3 is the real-time instrument telemetry rates used 
during side lobe operations. Note that for the first side lobe 
only, SWAVES and IMPACT alternated each week as to 
which receives the additional 385 bps. This was 
implemented in two separate downlink configuration 
macros’ and on board tables. 


Due to the low real-time downlink rates, the IMPACT Solar 
Wind Electron Analyzer (SWEA) instrument remained off 
for the duration of the side lobe operations. 


' A macro is a sequence of commands to accomplish a higher level 
function, i.e., SSR playback, configure for downlinking at 720 kbps, or 
autonomy rule safing response. 


After the Ahead observatory began side lobe operations, to 
increase science data return during side lobe operations, the 
first and second side lobe communications were tested with 
the DSN 34 meter subnet and ESA 35 meter stations (first 
side lobe only with ESA). It was determined that the 633 
bps/125 bps downlink/uplink rates met the 6 dB uplink 
margin and 2 dB downlink margin requirement on the first 
side lobe, however, there is only 3 dB margin on the uplink 
on the 2™ side lobe. 


While the current space weather table on board for 
downlinking at 633 bps contains only instrument data and 
spacecraft data is required for monitoring bus state of health 
during each track, two new macros and a new table were 
developed. This provided the usual one packet per minute 
of space weather for each in-situ instrument, 346 bps for 
SECCHI, and 140 bps for spacecraft housekeeping. This 
new table was also used in between DSN tracks during side 
lobe operations. Note that SSR playback did not occur 
during 34/35 meter supports as the downlink rate is too low 
for it to be useful. 


Use of the DSN 34 meter subnet and ESA 35 meter stations 
results in use of 13 additional antennas to provide not only 
increased science data return along with the daily 70 meter 
supports, but also provided for uplink coverage when no 70 
meter stations were available. 


Before entering solar conjunction, the instruments were 
powered off, except for SWAVES, and the SSR pointers 
reset. The Data Summary Table, which records the 
maximum and minimum of all analog voltage, current, 
temperature, and pressure telemetry, was dumped and reset. 


5. OBSERVATORY CONFIGURATION 
HCLT Enforcement of Safe Mode during Solar Conjunction 


During extended periods of communications blackout, the 
HCLT times out repeatedly at intervals of 72.332 hours, 
with each timeout triggering a full system reset and 
transition to Safe Mode. Throughout the blackout period 
during the solar conjunction — altogether 105 days for 
STEREO Ahead, 60 days for STEREO Behind — the 
STEREO Ahead observatory undergoes 35 system resets 
and transitions to Safe Mode, and STEREO Behind 
undergoes 20 system resets and transitions to Safe Mode. 
Because of this frequent and periodic enforcement of Safe 
Mode configuration during solar conjunction, the only 
practical means of controlling the observatory configuration 
during solar conjunction is to reengineer the observatory’s 
Safe Mode configuration itself. 


Replacing “Earth Acquisition” Safe Mode 


In the STEREO observatories’ original fault protection 
design, the system reset function mainly consisted of a 
sequence of field-programmable gate array (FPGA) encoded 


Table 3. STEREO Instrument Real-time Telemetry Rates during Solar Conjunction Mission Phase 


Resource IMPACT PLASTIC SECCHI SWAVES Total Allocation 
On during side-lobe Yes Yes Yes Yes 

operations? 

On during superior No No No Yes 

conjunction? 

SSR usage (Gbits) 1.253 1.253 0 1.645 4.151 4.294 
Side lobe 1 

SWAVES Prime R/T 0.679 0.6673 5.41 0.460586 7.216886 7.22 
on side-lobe | (kbps) 

IMPACT Prime R/T 1.064 0.6673 5.41 0.072533 7.213833 7.22 
on side-lobe | (kbps) 

Side lobe 2 

R/T on side-lobe 2 0.328 0.184 1.075 0.072533 1.659533 1.658 
(kbps) 


power switching actions capable of reliably reconfiguring 
the spacecraft even if there is no functioning flight 
processor. Part of this hardware sequence triggers board- 
level resets of the two onboard processors - the Control and 
Data Handling (C&DH) Processor, which controls the MIL- 
STD-1553 data bus, and the Guidance and Control (G&C) 
Processor. Both processors subsequently boot, load, and 
initiate their respective operational flight software programs 
that are stored in Electrically Erasable Programmable Read- 
Only Memory (EEPROM). 


Whereas the G&C Processor is only capable of running the 
dedicated G&C software application to support spacecraft 
Operations, two independent software applications are 
available to run on the C&DH Processor - the C&DH 
software application and the EA software application — 
either of which may be loaded and initiated on the C&DH 
Processor. The C&DH software application is the principal 
operating software for the C&DH Processor, and is used to 
support all STEREO commissioning and science operations 
requirements. The EA software application is the fallback 
in case of a critical system fault or failure. From the 
beginning of the STEREO mission, the C&DH Processor 
had been configured to load and initiate the EA software 
application in response to a system reset. 


Within the context of the STEREO observatories’ single- 
string redundancy architecture, the EA software application 
allows the C&DH Processor to perform all essential Safe 
Mode functions even if the G&C Processor has failed. 
However, compared to the combined functionality offered 
by the C&DH and G&C Processors running C&DH and 
G&C software applications, respectively, the EA software 
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application provides limited functionality, having no 
support for HGA pointing and no support for routing of 
instrument commands and collection of instrument 
telemetry. 


Because the EA application software requires the usage of 
IMU measurement data for control of spacecraft attitude, the 
new constraint against excessive IMU on-time dictates the 
abandonment of EA application software in advance of the 
solar conjunction, and for the remainder of the STEREO 
mission. 


Consequently, the first step in reengineering STEREO’s 
Safe Mode for solar conjunction is to reconfigure the 
C&DH Processor to load and initiate the C&DH software 
application instead of the EA software application in 
response to a system reset. This change in the STEREO 
boot loader software behavior is implemented by setting an 
avionics hardware logic discrete that the boot loader uses to 
determine which operational software to load into C&DH 
processor random-access memory (RAM). 


New “Solar Conjunction” Safe Mode 


The remaining engineering problem to solve is to utilize the 
available C&DH software functionality to establish the 
desired observatory configuration for solar conjunction 
operations. Following each system reset, the C&DH 
software is capable of automatically running pre- 
programmed macro command sequences that have been 
stored in C&DH processor EEPROM. Such macro 
command sequences may include unconditional command 


sequences executing upon software initiation, or conditional 
command sequences triggered by autonomy rules” or 
timetag rules. These software-executed command 
sequences thus are the last component of an overall system 
reset sequence that includes the following (in order): 


a. A non-modifiable FPGA-encoded sequence of power 
switching actions, originally designed to reconfigure the 
observatory for EA Mode operations. 


b. Board-level resets of the C&DH and G&C Processors, 
with the C&DH Processor reconfigured to load and initiate 
the C&DH software application instead of the EA software 
application. 


c. Stored programmable command sequences executed by 
the C&DH software application to further reconfigure the 
observatory from the EA Mode configuration to a new 
“Solar Conjunction” Safe Mode configuration supporting 
solar conjunction operations. 


Active G&C Actuators 


As in all observatory modes, attitude control is maintained 
using four reaction wheels, except when dumping 
momentum, when thrusters are used for up to several 
minutes. “Solar Conjunction” Safe Mode retains the ability 
to point the HGA at the Earth, which is necessary to resume 
communications _post-solar conjunction as LGA 
communications are marginal due to solar scintillation 
interference effects and the 2 AU distance. As the FPGA 
hardware sequence powers off the HGA Rotary Actuator 
(HGARA) during each system reset, it was therefore 
necessary to power the HGARA back on using the autoexec 
macro command sequence. 


Spacecraft Attitude Control Mode 


To evenly distribute the solar pressure body torques and 
minimize the build-up of system momentum throughout 
solar conjunction, the G&C software is commanded during 
solar conjunction to a “rotisserie” mode, rotating slowly at 5 
degrees per minutes about the spacecraft-Sun line. This 
reduces the likelihood of unobserved autonomous thruster 
firings during the solar conjunction period. 


G&C rotisserie mode is initiated and terminated via absolute 
timetag/macro command sequences so that rotisserie mode 
is only in effect during the predicted solar-conjunction 
communications blackout period. Following each HCLT- 
initiated system reset, G&C is commanded to rotisserie 
mode if the onboard coordinated universal time (UTC) 
clock has passed the solar conjunction entry time (for 
STEREO Ahead, this is set to 00:00:00z on March 24, 
2015). HGA steering is disabled whenever the spacecraft is 
in rotisserie mode. G&C is similarly commanded back to 


4 Autonomy rules are uploadable data structures that work with an on board 
rule engine to implement “IF-THEN” logic. For example, IF an instrument 
temperature reading is above 50° for 10 seconds, THEN turn it off. 
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nominal 3-axis inertial attitude control (with HGA auto- 
steering enabled) if the onboard clock has passed the solar 
conjunction exit time (for STEREO Ahead, this is 00:00:00z 
on July 7, 2015). 


Outside of the solar conjunction blackout period, the G&C 
attitude control mode is determined based on the antenna in 
use. When the RF signal path is switched to the HGA or the 
-Z LGA (on the same side of the spacecraft as the HGA), 
G&C is commanded to nominal 3-axis inertial attitude 
control with HGA auto-steering enabled. When the RF 
signal path is switched to the +Z LGA (on the opposite side 
of the spacecraft as the HGA), G&C is commanded to the 5° 
/minute rotisserie mode with HGA steering disabled. 


Antenna Selection 


The FPGA hardware reset sequence unhelpfully switches 
the RF signal path to the +Z LGA following each System 
Reset. To establish the desired HGA configuration for the 
solar conjunction blackout period, commands switching the 
RF signal path from the +Z LGA to the HGA were added to 
the autoexec macro command sequence. 


Supplemental to the initial HGA configuration enforced 
periodically at 72.332 hour intervals, an antenna round- 
robin sequence was incorporated, such that at 24 hours after 
each system reset, the RF signal path is switched from the 
HGA to the —Z LGA, and at 48 hours after each system 
reset, the path is switched from the -Z LGA to the +Z LGA. 
The 24-hour round-robin switchover to the —Z LGA is 
implemented via relative timetag rule/macro command 
sequence, with the triggering timetag loaded as part of the 
autoexec macro command sequence, then executing after a 
“relative” delay of 24 hours. The 48-hour round-robin 
switchover to the +Z LGA is implemented via autonomy 
rule/macro command sequence, conditional on no uplink 
commands being received for 48 hours. This autonomy 
rule/macro sequence is part of the fault protection system, 
and was inherited unchanged from the long-term science 
operations mode. 


X-Band Transponder 


The FPGA hardware reset sequence performs a hardline 
reset of the Small Deep Space Transponder (SDST) during 
each system reset, after which stored macro command 
sequences are used to establish one of two configurations 
used for solar conjunction. The first configuration is the 
default emergency mode, with the uplink set for 7.8125 bps 
non-return-to-zero level (NRZ-L) and the downlink set for 
11.712 NRZ-L, Turbo rate=1/6 coding, and is used when the 
selected antenna is either the “-Z” or “+Z” LGA. The 
second configuration consists of an uplink set for 125 bps 
NRZ-L and the downlink set for 633 bps B-Phase-L, Turbo 
rate=1/6 encoding, and is used when the selected antenna is 
the HGA. The SDST configuration changes are 
implemented alongside the antenna round robin transitions. 


Traveling Wave Tube Amplifier (TWTA) 


With each system reset, the FPGA hardware sequence 
demotes the TWTA to a non-transmitting Standby Mode as 
part of its load shedding function. A conditional autonomy 
rule/macro command sequence is responsible for turning on 
TWTA transmissions if battery pressure is over a minimal 
threshold for 230 seconds. This autonomy rule/macro 
sequence is part of the fault protection system, and was 
inherited unchanged from both the legacy EA Mode and the 
long-term science operations mode. 


Analysis of the loss-of-communications anomaly on 
STEREO Behind revealed there to be no _ onboard 
mechanism for automatically powering on the TWTA if 
some unanticipated failure were to leave it switched off. 
This situation would leave the spacecraft unable to 
broadcast a downlink signal without the intervention of 
ground-station uplinked commands. To fill this gap in 
functionality, commands powering on the TWTA box and 
the Electronic Power Conditioning (EPC) filament were 
added to the autoexec macro command sequence. 


Science Instruments 


As part of the load-shedding function of each system reset, 
the FPGA hardware reset sequence switches off the 
operational power of all science instruments, while 
switching on their associated survival heaters. For solar 
conjunction, the SWAVES instrument is powered back on 
(and the survival heater powered back off) to continue 
collecting science data at a reduced one-packet-per-minute 
cadence throughout the solar conjunction period. 


As SWAVES science gathering was to be accommodated 
during solar conjunction but otherwise not supported for 
safe mode situations beyond solar conjunction, the 
SWAVES power-on was implemented via conditional 
command sequence rather than being incorporated directly 
into the autoexec macro command sequence. Specifically, 
this functionality was attached to the absolute timetag/macro 
command sequence used to initiate G&C rotisserie attitude 
control following each system reset if the onboard UTC 
clock has passed the solar conjunction entry time (for 
STEREO Ahead, this is 00:00:00z on March 24, 2015). 
This implementation simplified removal of the automatic 
SWAVES power-on in safe mode functionality once normal 
science operations are restored post-solar conjunction. 


Thermal Control 


As part of the load shedding function of each system reset, 
the FPGA hardware reset sequence disables all spacecraft 
operational and interface heaters, and enables all spacecraft 
survival heaters. Because of the long duration of the solar 
conjunction period, the decision was made to forego this 
minimum power load configuration, and replicate the 
thermal control configuration used for long-term science 
operations so as to moderate any changes to the spacecraft’s 
temperature profile. This configuration consisted of all 
spacecraft operational and interface heaters enabled, and all 
spacecraft survival heaters disabled. 
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The command sequence enabling spacecraft operational and 
interface heaters and disabling spacecraft survival heaters 
was added to the absolute timetag/macro command 
sequences that trigger at solar conjunction entry and exit. 
Once normal science operations are restored following solar 
conjunction, these command sequences are removed, as 
demotions to safe mode are expected to be of relatively 
short duration. 


6. FAULT PROTECTION MODIFICATIONS 


Fault protection Modifications for Solar Conjunction 


For the solar conjunction mission phase, fault protection 
established the following phases of attitude control for 
spacecraft safety and effective communications, see Figure 
8. Phase 2 entry and exit is controlled by absolute timetags 
stored in the on board startup sequence in EEPROM 
corresponding to the 2° SPE entry/exit points. 


| os. | 12-24 hrs 24-36 hrs 36-48 hrs 48-60 hrs | 60-72.332 hrs 
#1 


Pre-conjunction 
_ es aeaien! Raaeeees | Seen eae a oe) 
#2 
Conjunction 


Post-Conjunction 


#3 


Figure 8. Fault Protection phases of attitude control and 
RF antenna configuration for solar conjunction mission 
phase 


Fault protection changes necessary for maintaining the 
health and safety of observatories during the two to three 
month long solar conjunction periods consists of the 
following: 


e Providing thermal protection for the HGA feed 
assembly (this protection is via G&C parameters, 
not autonomy rules) 


e Preserving the limited remaining life of the 
surviving IMU 


e §=Protecting against harmful effects upon an IMU 
failure 


e Minimizing system momentum accumulation 


HGA thermal protection was implemented with off-pointing 
and using the first two side lobes for communications. The 
HGA soft stop parameter provides further protection by 
preventing the feed assembly from ever looking too close to 
the Sun. It is set by a G&C parameter in EEPROM as 
follows: 


e Ahead = 8.1° 


e ~=Behind = 6.8° 


The use of the second side lobe for HGA communications 
during entry and exiting of solar conjunction is controlled 
by the HGA angle bias G&C parameter which is set to the 
following in EEPROM: 


e Ahead = 6.1° 
e = Behind = 6.2° 


The flight software computes the HGA rotation angle using 
the current SPE angle and these two GC parameters as 
follows: 


HGA angle = larger of (SPE angle + HGA angle bias) and 
HGA soft stop 


The limited remaining IMU lifetime is maintained by: 


e powering the IMU off immediately after a system 
reset 


e powering-on the IMU if the ST is unhealthy or 
“lazy” 


e powering on the IMU if the flight software 
determines that an autonomous momentum dump 
is necessary 


e powering off the IMU two hours after the star 
tracker is locked and operating nominally 


To protect against a persistent IMU failure, a G&C software 
patch is applied by the on board startup sequence which will 
prevent bad IMU data from being used by the G&C 
application. 


7. GUIDANCE AND CONTROL SUBSYSTEM 
MODIFICATIONS 
A very small set of G&C parameters were changed to 


directly support the solar conjunction configuration. Those 
parameter changes include: 


e Earth & Spacecraft ephemerides — Due to the 
possibly very long conjunction period (it was 


unknown in advance at what SPE angle 
communications would significantly degrade), 
long-duration spacecraft and Earth orbital 


information was required to be uploaded to the 
spacecraft so that the spacecraft can point the HGA 
at the Earth when it exits conjunction. These 
ephemerides, which usually cover a_ three 
(spacecraft) month or six (Earth) month period, 
were uploaded to cover out to early February, 
2016, which was felt to be the absolute worst-case 
blackout period. Heading into solar conjunction, 
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these parameters were routinely updated as long as 
an adequate communications link was available up 
until the conjunction period. 


e HGA pointing parameters — Described above in 
section 6. 


These were the only G&C parameter changes explicitly 
required to support solar conjunction operations. 


As a result of the anomalous Behind spacecraft loss of 
communications during the on-orbit solar conjunction 
testing on October 1, 2014, a few additional G&C parameter 
changes were made the most significant of which was to 
change the maximum amount of time that an autonomous 
momentum dump is allowed to complete. At launch this 
value was set to seven minutes and it had not been changed 
since all momentum dumps during the mission had been 
initiated via ground command. Commanded momentum 
dumps have typically taken 3-4 minutes to complete, and so 
7 minutes is certainly quite a bit longer than should be 
necessary. Further, commanded momentum dumps 
typically bias the momentum in the opposite direction so 
that momentum goes through zero and then back up again. 
This minimizes the science-disrupting dump occurrences. 
For spacecraft-initiated autonomous dumps, however, the 
targeted angular momentum is always zero, and so a 
momentum dump time-out of approximately half (95 
seconds) of the normal dump time will enable the majority 
of momentum to be removed from the system should an 
autonomous dump be required during solar conjunction. 
(Note that with the spacecraft rotating during conjunction, 
momentum accumulation is minimized and few, if any, 
autonomous dump should be needed.) 


8. GROUND SYSTEM CONFIGURATION 


Several ground system configuration changes are necessary 
for solar conjunction and side lobe operations. We selected 
the DSN 70 meter track coverage with daily three hour 
duration to ensure observatory health and safety. The 70 
meter stations provide 3 and 10 kbps downlink rates for 
reduced real-time science during side lobe operations. 
When the 70 meter stations are not available, the 34 meter 
stations are used to provide additional coverage at the 633 
bps downlink rate, which further limits real-time science 
and observatory state of health checks. The extra 34 meter 
tracks increase the science return and allow the operations 
team to command the observatory daily. 


During side lobe testing, insufficient ranging margin was 
measured on the Ahead and Behind observatories for both 
side lobes, which indicated ranging data would be 
intermittent operationally. The Flight Dynamics Facility 
(FDF) at GSFC determined that it could meet the ephemeris 
accuracy requirements (three sigma six month prediction) 
using Doppler data only. As a result, the DSN adjusted 
T1/T2 ranging settings in the nominal sequence of events, to 


decrease ranging measurement sampling from one per 
minute to once every six minutes to decrease ranging 
dropouts. 


The track automation in the MOC performs operator 
functions for routine ground system operation and 
observatory commanding, health and safety checks. Track 
automation modifications were made to conduct operations 
more efficiently with the reduced track durations and 
telemetry rates. With these modifications, unattended 
commanding starts 35 minutes earlier instead of waiting for 
the usual round trip light time (RTLT) verification of the 
uplink sweep. To avoid commanding problems caused by 
solar interference, the MOC changed all commanding to use 
the COP-1 bypass mode, which prevents communications 
operation procedure-! (COP-1) sequence number failures 
due to dropped commands. The beginning of track (BOT) 
test command was increased to 10 commands (subsequently 
to 30 due to the effects of solar interference) to ensure the 
observatory received commands daily to prevent the 
command loss timers (CLT) from expiring, which would 
have complicated operations with contingency recovery for 
system resets and low gain antenna usage. The automated 
telemetry checks were modified to account for the reduced 
telemetry rates and the pre/post conjunction observatory 
configurations. 


The operational procedures and scripts were revised and 
new ones were created for side lobe and solar conjunction 
entry/exit operations. The entry and exit procedures keep 
the operations team organized during critical operations, 
such as HGA angle bias off-pointing, instrument power 
down/up, and the observatory system reset into the 
conjunction phase. The standby mode reset recovery 
procedure was modified to handle the new system reset 
startup macro and post-conjunction configuration changes, 
which is vital for returning the observatory to operational 
mode and science collection promptly. New templates for 
the Scheduler planning software were created to plan events 
for side lobe track operations. Creating side lobe templates 
instead of making significant changes to existing operational 
templates helped the team transition back efficiently to 
planning for routine track operations. All procedures and 
scripts are tested on the hardware-in-the-loop (HIL) 
simulator before operational use. 


9, GROUND SYSTEM TESTING 


STEREO utilizes two HIL simulators, designated HIL-A 
(Ahead) and HIL-B (Behind). Each incorporate elements of 
an engineering model avionics to create a "spacecraft on the 
ground" that provides a high fidelity testbed for spacecraft 
simulations. To emulate "missing parts' of the spacecraft, 
the STEREO Testbed System (STSS) was utilized. The 
STSS also contains models to simulate the operational 
environment (orbit, attitude, etc.). Each HIL is controlled 
from its own workstation via the commercial off-the-shelf 
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(COTS) command and control application, EPOCH 2000, 
the same command and control system used in the MOC. 


Once created, a new memory object release is first loaded to 
RAM on the HIL, then dumped, verifying its integrity via 
cyclic redundancy check (CRC) (unit testing). Functional 
testing then commences. Depending upon the nature of the 
change, some functional verification can be more 
challenging than others. If, for instance, the object release 
contains a new or updated parameter value, the individual 
parameter could easily be dumped and visually verified. A 
new or updated macro would require the user to execute the 
macro and then check appropriate system logs to verify 
command timing and execution. An updated autonomy rule 
would require the user to further configure the system to 
‘trip’ the autonomy rule and verify that the premise and 
response acted as anticipated (visual and system log 
verification). Once the object release passes functional 
testing, it is loaded to EEPROM on the HIL. The HIL setup 
scripts would also be updated to include the call to the new 
configuration verification script. At this point the new 
object release can be scheduled for loading to the actual 
spacecraft, first to RAM, then to EEPROM two weeks later. 


Test plans were created for solar conjunction system level 
tests. These provided test scenarios, including test set-up 
instructions and pass/fail criteria. Test activities were 
summarized in a spreadsheet — test objective, test start/stop 
times, detailed test steps, test issues, anomalies etc. 
Archived test data was available to the engineering team 
shortly after each test for a further, more detailed review. A 
discussion of significant test results took place at weekly 
solar conjunction meetings. The following is a list of key 
tests run on the HIL in preparation for solar conjunction: 


e Post-Reset, Initial Condition Verification Test(s) 

e Post-Phase 2 System Reset Test 

e Soft Command Loss Timer Test(s) 

e Expired Ephemeris Test 

e Autonomous Momentum Dump Test(s) 

e Momentum Dump Without An IMU Test 

e Lower Star Tracker TEC Temperature Test(s) 

e IMU Code Patch Test(s) 

e Operational Longevity Test(s) 
On-obit solar conjunction testing includes resetting the 
actual spacecraft into the solar conjunction configuration 
(most solar conjunction configuration items are dormant, in 
EEPROM, only activated through a system reset). The 
spacecraft then remains in this configuration for 72.332 


hours, during which time it cycles through each of the three 
antenna configurations, and then autonomously resets 


following expiration of the hardware command loss timer. 
A simulation of this timeline was executed on the HIL prior 
to the on-orbit test. The HIL was first configured to current 
on-orbit settings, and then transitioned to the solar 
conjunction configuration via a system reset, where it 
remained for the next three days. During this time, 
anticipated antenna switches were observed along with other 
key milestones. Following the test, data was accessed from 
the archive by the engineering team to analyze system 
performance throughout the three day period. This system 
level longevity test was instrumental in ensuring that the 
memory objects and planned sequences would execute as 
expected on the spacecraft. 


10. ON ORBIT OBSERVATORY TESTING AND LOSS 
OF COMMUNICATIONS WITH STEREO 
BEHIND 


The solar conjunction mission phase requires extensive 
changes to both spacecraft configurations. The potential for 
errors and unintended consequences is _ significant. 
Therefore a robust testing effort is required. 


The STEREO operations team maintains a fairly high 
fidelity hardware-in-the-loop (HIL) simulator for testing 
spacecraft command sequences on the ground. While much 
of the spacecraft is simulated in software, the simulator 
contains replicas of the spacecraft’s flight processors and 
portions of the power subsystem. Thus the simulator runs 
the actual flight software on identical hardware. Such 


simulators are sometimes called “flat-sats.” This project 
refers to it as the “HIL.” 
All configuration changes (parameter values, stored 


commands, autonomy policies and responses) made for 
solar conjunction were tested on the HIL. But is this 
sufficient? The project determined that it was not. For 
example, the HIL cannot fully simulate an HCLT system 
reset. Therefore it was decided to conduct controlled tests 
on each spacecraft. 


Six days were requested from the science teams to test the 
solar conjunction operations as it will occur for each 
observatory. In summary, using the DSN, the procedures 
for entry into solar conjunction, 3 days for the HCLT 
initiated system reset to occur, exiting of solar conjunction, 
and returning the instrument suites to nominal science data 
return were tested on orbit. The daily detailed test sequence 
of events for each observatory is shown in Tables 4 and 5. 


Table 4. Ahead On-Orbit Observatory Testing of Solar 
Conjunction Configurations 


Sunday, July 6", 1420z, Day 1 — Pre conjunction 
configuration 


> 800z - Power 
commands 


off instruments via _ timetag 
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> Playback SSR 


> Switch to HGA 1 side lobe before end of track 
(EOT) 


Monday, July 7", 0530z, Day 2 — Momentum dump on 


HGA 1" side lobe & reset into solar conjunction 
configuration 
> Acquisition of signal (AOS) using HGA 1™ side 
lobe, 10 kbps/500 bps 
> MOps planned momentum dump with IMU on - 
Set target for conjunction period entry 
> System reset (CCD_SYSTEM_RESET) - Test 


phase | configuration (3-axis) 


Tuesday, July 8", 0550z, Day 3 — Monitor solar conjunction 
configuration — phase | (3 axis) 


> AOS using HGA 2™ side lobe, 633 bps/125bps 


Wednesday, July 9", 0105z, Day 4 -— Monitor solar 
conjunction configuration — phase 2 (rotate) 


> AOS using HGA 2™ side lobe, 633 bps/125bps 

> Reset + 41 hours = Test MET timetag to rotate 
macro 478 (phase 2) 

> Reset + 48 hours = switch to —Z LGA (phase 2) 
(occurred outside of DSN track) 

> Reset + 60 hours = switch to +Z LGA (phase 2) 


(occurred outside of DSN track) 


Thursday, July 10", 0015z, 0930z, & 2155z, Day 5 - HCLT 
firing — phase 2 (rotate) & Post conjunction configuration 


> AOS using + Z LGA rotating, 12 bps/7.8bps 

> Reset + 72 hours = HCLT fires, S/C resets 

> Reset + 10 hours = Test UTC timetag fire to stop 
rotation macro 479 (occurred outside of DSN 
track) 

> AOS using HGA 2™ side lobe, 633 bps/125bps 

> Switch HGA to offpoint 1 deg on main lobe 

> Playback SSR & Reconfigure SSR for science 


operations recording 
Friday, July 11", 0530z, Day 6 - Power on instruments 
> AOS using HGA offpoint 1 deg, 360kbps/2000 bps 
> Reset recovery & load timetags 


> Power on all instruments 


> Switch to HGA main lobe before EOT 


Saturday and Sunday, Days 7 & 8 - Return to nominal 
science operations 


The actual events tested for the solar conjunction mission 
phase are highlighted in yellow in the timelines in Figures 6 
and 7. Note that for comparison, the timeline scale is the 
same for both observatories. Issues were tracked and 
anomaly reports and change requests were generated as 
necessary. A post-test review of results and issues was held. 


In July 2014, a week was spent conducting realistic solar 
conjunction testing on STEREO Ahead. The tests did 
indeed uncover several minor issues with the configuration 
changes. Adjustments were made accordingly, and then we 
conducted a similar test on STEREO Behind in late 
September 2014. 


Table 5. STEREO Behind On-Orbit Observatory 
Testing of Solar Conjunction Configurations 


Saturday, Sep 27", 1550z, Day 1 — Pre conjunction 
configuration 


> 1800z Power off all instruments 


SWAVES via timetag commands 


except 


> Playback SSR 


> Load momentum dump, #67, for ignition @ 1630z 
the next day 


Sunday, Sep 28", 1530z, Day 2 — Momentum dump on 
HGA 1* side lobe & reset into solar conjunction 


> AOS using HGA 1" side lobe, 10 kbps/500 bps 


> 1630z - Momentum dump with IMU on - Target 
set for conjunction period entry, 8 Nms 
> 1730z - System reset (CCD_SYSTEM_RESET) - 


Test phase 2 configuration (rotating), SWAVES 
On 


Monday, Sep 29", 0100z, Day 3 -— Monitor solar 
conjunction configuration — phase 2 (rotate) & 3 (3-axis) 


> AOS using HGA 2™ side lobe, 633 bps/125bps 


> 0530z = Reset + 12 hours = Test UTC timetag fire 


to stop rotation (macro 479) (occurred outside of 
DSN track) 


Tuesday, Sep 30", 0900z, 1615z, Day 4 — Monitor exiting 
solar conjunction — phase 3 (3-axis) 


> AOS using HGA 2™ side lobe, 633 bps/125bps 


> 1730z = Reset + 48 hours = switch to -Z LGA 


(phase 3), 3-axis monitored using a 34m station 
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Wednesday, Oct 1“, 1530z, Day 5 - HCLT firing — phase 3 
(3-axis) & Post conjunction configuration 


> 0530z = Reset + 60 hours = switch to +Z LGA 
(phase 3), rotate (occurred outside of DSN track) 

> AOS using + Z LGA rotating, 12 bps/7.8bps = +Z 
LGA calibration for ~2 revolutions 

> 1750z = Reset + 72 hours = HCLT fires, S/C resets 

> Reacquire on HGA 2™ side lobe, 633 bps/125bps, 
3-axis 

> Before EOT, Switch HGA to offpoint 1 deg on 


main lobe 


Thursday, Oct and. 0045z, 0805z, 1535z, & 2320z Day 6 - 
Power on instruments & return to science Ops 


> AOS using HGA offpoint 1 deg, 120 kbps/2000 
bps 

> Playback SSR & Reconfigure SSR for science 
operations recording 

> Switch to HGA main lobe before EOT 

> Reset recovery & load timetags 

> 1635z = Power on all instruments 


Friday, Oct 3, Day 7 - Return to nominal science 
operations 


The test on STEREO Behind started with a commanded 
system reset. This was observed from the ground during a 
station contact. The ST was slightly “lazy” following the 
reset. Onboard autonomy rules powered up the IMU to 
provide body rate measurements while waiting for the ST to 
achieve lock. The ST achieved lock about 12 minutes later, 
and onboard autonomy powered off the IMU to preserve its 
life. While not desired, this behavior was not unexpected 
because the system reset power-cycles the ST. 


The plan then called for sending no commands for 3 days to 
allow the HCLT to reset the system, just as it would (many 
times) during solar conjunction. Over the course of those 3 
days, several station contacts occurred, allowing mission 
operators to observe telemetry. From this it was confirmed 
that the spacecraft was performing exactly as planned. 


At the end of those 3 days, on October 1, 2014, after the 
Behind observatory had completed its on orbit testing, the 
HCLT-initiated reset was observed during a DSN 70 meter 
station with the radio science receivers recording. Among 
the many spacecraft actions taken during a reset are power- 
cycling both the ST and the transponder. The drop in 
telemetry and the reappearance of the spacecraft carrier 
signal were observed at exactly the expected times. But a 
few minutes later, the carrier was lost. 


About 10 days later, DSN radio scientists reprocessed the 
recorded radio signals from that last contact and were able 
to pull out a few telemetry packets. From these it was 
learned the ST had once again been lazy and that onboard 
autonomy had once again powered up the IMU. Also, it 
was learned that the X-axis gyroscope had spontaneously 
failed a few seconds after power-up. Now, if the X-gyro 
had simply “winked out,” the spacecraft probably could 
have recovered. But, unfortunately, the failure was such 
that the X-gyro continued to provide rate measurements, and 
they were noisy and likely biased. Once again, if the 
measurements were only noisy, the spacecraft would likely 
have survived. Biased measurements, on the other hand, are 
life-threatening. 


It is believed that the biased measurements led the 
spacecraft software to command the reaction wheels to 
respond to a perceived roll rate. Since the rate was false, the 
software would be unable to null it, resulting in the reaction 
wheel speeds climbing higher and higher. Eventually, the 
wheels would saturate, and the flight software would 
attempt to fire thrusters to slow the perceived rotation rate. 
Simulations have shown that firing thrusters in the presence 
of a biased rate measurement would likely make the spin 
worse. 


In short, it is believed that the gyro failure led to the 
spacecraft spinning up and turning away from the Sun. 
Within a few hours, the battery would be drained, and the 
spacecraft would start to freeze. A NASA Failure Review 
Board was convened and concluded that the loss of 
communications was due to a simultaneous double failure of 
G&C sensors. Over time, the spacecraft could thaw and 
slow down and recommended that the project continue to 
periodically try to reestablish communications with 
STEREO Behind". 


11. POST CONJUNCTION ASSESSMENT 


Post solar conjunction assessment objectives are to maintain 
the health of the spacecraft bus subsystems, evaluate their 
performance to collect science data, and ensure optimal 
performance of the limited lifetime resources. To 
accomplish this, STEREO mission operations uses an 
automated performance assessment function. This 
automated system provides the necessary tools to analyze 
data for anomaly investigations. Missions operations 
needed to take into consideration that the solar conjunction 
blackout period is 60 to 105 days and side lobe duration is 
400 to 449 days. The automated assessment system is setup 
for a daily flow, not for analyzing months of data. With the 
SSR playback at 3 kbps, Ahead would require 126 hours, or 
16 days (105 day blackout, 8 hour tracks/day), and Behind 
would require 72 hours, or 9 days (60 day blackout, 8 hour 
tracks/day). 


The Ahead observatory entered the solar conjunction 
blackout period with 40 days of spacecraft SSR data to 
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downlink. To ensure optimal performance, mission 
operations began downlinking all 145 days of data that had 
been recorded during the conjunction. It took six weeks to 
downlink all of it in multi-day chunks. Using the existing 
daily assessment processing modified to allow for N days 
processing, 4 or more day’s data was processed each day. 
The processing progress was monitored daily to optimize 
the days processed until all the backlogged data was 
processed. The same process was used again starting in 
November 2015 once the HGA had returned to the main 
lobe, as the entire contents of the SSR, including all the in- 
situ instrument science data, was played back in 3 to 4 days. 
As 15 months of science data were being processed, 
missions operations notified the instruments teams weekly 
as to progress of Level 0 science data availability. 


12. POST CONJUNCTION RESULTS 


Post superior solar conjunction, the Green Bank Radio 
Telescope detected the STEREO Ahead downlink signal 
from the HGA at an SPE angle of 0.4° on May 30, 2015. 
The Arecibo Observatory also detected the downlink signal 
at 0.6° SPE angle on June 4". Surprisingly, the downlink 
signal from the +Z LGA was detected at the 1.2° SPE angle 
on June 19" by the Green Bank Radio Telescope. 


On June 26, 2015, the first telemetry was received from 
STEREO Ahead post superior solar conjunction after the 
31" HCLT initiated system reset at a 1.5° SPE angle. The 
DSN received a strong downlink signal and telemetry using 
the Goldstone 70 meter station. The observatory was 
operating nominally continuing to rotate slowly while 
communicating on the 2" HGA side lobe as planned. The 
HGA feed temperature was within the predicted range at 
113° C. System momentum was at the anticipated level of 
8.0 Nms. As occurred during solar conjunction entry, after 
the 31“ HCLT reset, the star tracker was again “lazy” to re- 
acquire a solution causing IMU2 to power on for two hours. 
One additional anomaly occurred, reaction wheel #3 was not 
responding to G&C torque commands. While the 
observatory continued to rotate nominally and was designed 
to do so with three reaction wheels, as the observatory was 
healthy, contingency response to this G&C anomaly was 
delayed until July 8" to allow for more reliable 
communications when the SPE angle reached 2°. Daily 
starting on June 29", a three hour DSN 70 meter station 
tracked the Ahead observatory as it continued to switch 
antennas each day and RF performance was found to be 
highly dependent on solar activity. Due to solar 
interference, telemetry frame reception varied widely from 
13 to 94 percent on the HGA. While carrier lock was 
received on the LGAs, telemetry lock was never successful 
on the LGAs due to the low SPE angle. 


At 0000z on July 7", the Ahead observatory returned to 
nominal 3-axis attitude control as planned and after the 35" 
and last HCLT initiated system reset on July 8", post 


superior conjunction recovery operations began with the 
following significant activities: 


e Disabled wheel #3 from G&C control 


e Increased downlink rate to 3 kbps to flow 
instrument real-time telemetry (SWAVES only) 


e = Applied leap second 
e Spacecraft bus SSR data playback began 
e Loaded and verified track timetags 


Over the next few days, instruments were powered on and 
configured for continuing side lobe operations and 
spacecraft bus recovery operations were completed. The 
IMPACT SWEA instruments remained off due to low 
telemetry bandwidth until the HGA returned to the main 
lobe. On July 20", all instruments were returned to real- 
time side lobe science, with the three in-situ instrument 
suites continuing to record space weather data at one packet 
per minute. The IMPACT Suprathermal Ion Telescope 
(SIT) instrument required uplinking of several long 
calibration tables; due to solar interference on the uplink, 
this activity was postponed until August 26" after the 
observatory completely cleared the region of solar 
interference and the uplink rate increased to 500 bps on the 
1“ HGA side lobe. 


The STEREO spacecraft utilizes a diagnostic feature for 
recording significant events and anomalies on the SSR for 
quick assessment. These event and anomaly SSR partitions 
were downlinked first for quick look analysis and revealed 
that four soft low voltage shutdown (LVS) events had 
occurred. As the downlink rate from side lobe operations 
was very limited, the SSR read pointers were repositioned to 
playback the housekeeping data from the 12 day period 
which contained the soft LVS occurrences. After the data 
was analyzed, the cause of the wheel #3 not responding to 
torque commands was isolated to the wheel tripping its 
internal over speed protection limit during a slew caused by 
the resetting the observatory while the Earth and Sun 
vectors were closely aligned. Fault protection recovered the 
observatory to a safe Sun-pointing attitude each time. 
Wheel #3 was restored to nominal G&C control after power 
cycling it on July 16". 


During the post solar conjunction recovery operations on the 
HGA 2" side lobe, July 8" through 20", the command 
success rate varied from 65% to 100% depending on solar 
activity. During this time, the SPE angle increased from 2.0 
to 2.5°. While the downlink signal strength was very good 
during this time, the success rate for telemetry frames 
received also varied from 76% to 99% using the DSN 70 
meter stations. 


On August 16", the HGA was positioned to return to the 1“ 
HGA side lobe for communications to increase data rates, 
10 kbps on the downlink and 500 bps on the uplink, while 
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preventing overheating of the HGA feed assembly. This 
increased the HGA feed assembly temperature to 121.9° C, 
which was within the predicted range, with the HGA angle 
at 6.8°, with respect to the spacecraft-Sun line. 


On November 9", the Ahead observatory resumed 
operations using the main lobe of the HGA resulting in a 13 
dB signal increase. The HGA soft stop was set to 7.1° and 
the HGA rode along a 1° offset from the center of the main 
lobe till December 30" to keep the HGA feed assembly 
cool. This increased the HGA feed assembly temperature to 
119° C, which was within the predicted range. Even at a 1° 
offset, data rates increased significantly, 240 kbps on the 
downlink and 2000 bps on the uplink. The downlink rate 
gradually returned to the highest rate, 720 kbps, when 
communication on the center of the HGA main lobe 
returned on December 28, 2015. The National Oceanic and 
Atmospheric Administration (NOAA) antenna partners 
gradually were able to close the RF link on the space 
weather broadcast in between DSN or ESA tracks. 


With the increased downlink rate, the 15 months of in-situ 
instrument space weather data on the SSR were finally able 
to be played back. During the next five days, the 
instruments remained in their side lobe science 
configurations until the SSR could be reconfigured for 
nominal daily science operations. After the SSR was played 
back twice and all science data had been received, the SSR 
was successfully reconfigured for nominal science 
operations on November 16". As the spacecraft was not 
designed for side lobe real-time telemetry, to avoid a 
software design constraint that would cause real-time 
telemetry queues to jam, the SECCHI real-time telemetry 
was minimized for 10 hours in between tracks to ensure that 
the queues were emptied before returning to the higher data 
rates necessary for nominal science operations on the HGA 
main lobe. 


On November 17", the Ahead spacecraft bus 
reconfigurations were completed for returning to nominal 
science operations. After 454 days of side lobe and solar 
conjunction operations on Ahead, daily SSR playback, 
commanding, and tracking operations resumed. The 
IMPACT SWEA instruments were powered on and all 
instruments were configured for nominal daily science 
operations over the next few days. The MOC completed 
processing of the 15 months of in-situ instrument space 
weather data with the associated data products on November 
26". Daily science data return was gradually restored to 
prime science levels of 5 Gbits by December 28". 


Post conjunction, all instruments resumed nominal data 
collection with no ill effects from being powered down for 
several months. The HGA feed assembly temperature 
gradually returned to within tested operational limits, < 90° 
C, with no ill effects from being overheated for over two 
years. Only one lingering issue resulted from the solar 
conjunction on the Ahead observatory. G&C fine pointing 
losses and the magnitude of the attitude roll error increased 
slightly post solar conjunction. The SECCHI imaging 


instrument team reported that the magnitude of the attitude 
roll error was periodically affecting the Heliospheric images 
causing the post processing star-fitting algorithm to fail. To 
improve roll error performance, the G&C X-axis control 
bandwidth was adjusted. The G&C Rate Merge capability, 
which enables rate measurements from all sensors to be 
combined to form a "better" rate estimate versus picking 
only one sensor as the source of the angular rate 
measurement, was also enabled, which reduced the noise on 
the X-axis angular velocity estimate by ~50%. However, 
the cause for the changed G&C behavior has not yet been 
determined. Wear on the reaction wheel bearings seems 
like a possible explanation. 


The STEREO Behind observatory entered superior solar 
conjunction at the 2° SPE angle on January 22, 2015. 
Recovery efforts resumed post solar conjunction on May 4" 
through June 27", as the spacecraft had cleared solar 
interference for LGA communications. The NASA Failure 
Review Board recommendations |! were implemented 
consisting of battery state of charge recovery and powering 
on the downlink carrier. The Green Bank Radio Telescope 
and the Arecibo Observatory also observed the carrier 
recovery tracks. Due to Behind’s retrograde motion causing 
it to re-enter the region of solar interference, recovery 
operations were suspended from June 28" through 
November 29". The Behind observatory recovery 
operations resumed on November 30, 2015, using the DSN 
70 meter stations to command with the Green Bank Radio 
Telescope and the Allen Telescope Array also observing the 
carrier recovery tracks depending on availability. While the 
Arecibo Observatory also assists, the Behind observatory is 
only in view April through September. 


On the 25" attempt to re-establish communications with 
STEREO Behind, the DSN detected a strong downlink 
carrier at 2227 UTC on August 21, 2016 after contact was 
lost for over 22 months. At a spacecraft range of 2 AU, the 
observatory was found to be rotating slowly about its 
principal axis of inertia for which the uncontrolled attitude 
allowed some solar array input and continuous uplink and 
downlink communications on the LGA at emergency data 
rates. Over the next 22 continuous days, significant 
obstacles to recovery were overcome with a collaborative 
effort of the JHU/APL engineering team, NASA GSFC, 
DSN, FDF, GSFC Space Science Missions Operations 
(SSMO) scheduling, and Mission Operations teams. This 
consisted of: 


e Reliably commanding a rotating spacecraft with 
uncontrolled attitude at a distance of 2 AU. 


e How to power on the spacecraft that was never 
designed to be off without collapsing the battery 
voltage. 


e §€Acquiring telemetry at 35 bps from a spacecraft 
that is rotating with an uncontrolled attitude. 
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e Warming a frozen propulsion subsystem with a 
degraded battery and limited solar array input with 
an uncontrolled attitude. 


e Configuring, loading, and verifying EA, C&DH, 
and G&C parameters and macros with very limited 
telemetry. 


e Conducting an autonomous momentum dump in 
the blind and transitioning to C&DH standby mode 
and successfully receiving telemetry on the HGA 
indicating star tracker lock and decreasing system 
momentum. 


However, system momentum level remained above the 
threshold for re-establishing attitude control with the 
reaction wheels. Due to the uncontrolled attitude, 
communication degraded and the last detection of the carrier 
was on September 23, 2016. 


From the last telemetry received on September 18", the 
main bus voltage is low, 2 out of 11 battery cells are 
currently not functioning, attitude is uncontrolled, rotating at 
a ~45 second period about its principal axis of inertia. 
Propellant is suspected to be frozen and pressure transducer 
#2 is not functioning. EA mode is enabled. The battery 
charge rate is C/10. Necessary macro sequences have been 
tested to allow the peak power tracker in C&DH standby 
mode to protect the battery. These macro sequences will be 
loaded to EEPROM when the communications supports 
longer commands. 


Monthly recovery efforts will consist of attempting to power 
on the transmitter for 30 minutes. If no carrier signal is 
detected, battery recovery operations will commence which 
consist of repeatedly sweeping a 3 kHz uplink range and 
sending commands for maintaining battery state of charge. 


13. CONCLUSION 


The solar conjunction mission phase for STEREO was not 
initially required by NASA. Nevertheless, after 8 years post 
launch and multiple mission extensions, it became necessary 
to safely conduct superior solar conjunction and to continue 
science return post conjunction. The significance of this 
work for future deep space missions, for which a long 
superior solar conjunction is required, is that the mission 
must be designed to support it. Specifically, the spacecraft 
must be able to survive a long communication blackout 
safely. Also, a parabolic HGA cannot be used for 
communications on the main lobe within several degrees of 
Sun. The following lessons were learned for incorporation 
into future NASA missions. 


1. Add value based requirements for the extended mission 
phase for NASA missions. NASA missions are 
designed for the duration of the prime science success 
criteria. They do not reflect the reality for average 


NASA observatory lifetime, which is typically greater 
than 9 years. During development, value based 
requirements should be discussed for continuing the 
mission beyond the prime science phase to include all 
subsequent mission significant orbital events. For 
example for STEREO, adding a single requirement for 
safe survival of the months long superior solar 
conjunction would have uncovered the following: 


e HGA feed thermal issue 
Unmodifiable 3 day HCLT initiated system 
resets 


Star tracker power off for each system reset 


e No RF margin on LGAs at a2 AU range 

Don’t make the hardware command-loss timer (HCLT) 
unmodifiable. Rather design the HCLT duration as an 
uploadable parameter. If this feature had been 
available, we would have set the timeout value to a 
large number to prevent the 35 system resets during the 
blackout period. This action would have prevented the 
4 LVS events and the reaction wheel over-speed latch- 


up. 


Allow the system reset hardware response to be 
modified post-launch, i.e., EEPROM, not FGPA. For 
example, STEREO’s unmodifiable reset sequence turns 
the star tracker off. The powering on and subsequent 
slow star re-acquisition of the star tracker was a 
contributing cause of the Behind loss of communication 
anomaly. 


Set the battery charge current to maximum at start-up 
power initialization and after going into low state of 
charge operation to allow maximum charging 
capabilities with available solar array power. This 
design change would improve the odds of recovering a 
spacecraft from a depleted battery condition. 


If a spacecraft has redundant IMUs, allow for cross 
strapping between individual units so as to permit full 
three axis coverage using any combination of sensors 
capable of providing measurements along three 
mutually perpendicular axes. Further, individual IMU 
units should be oriented on the spacecraft in a way that 
permits maximum flexibility in combining outputs 
while covering three mutually perpendicular axes. 
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